Vulnerability Description
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, double free of memory allocation is possible in Kernel when it explicitly tries to free that memory on driver probe failure, since memory allocated is automatically freed on probe.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Android | - |
Related Weaknesses (CWE)
References
- https://source.android.com/security/bulletin/pixel/2018-09-01#qualcomm-componentPatchVendor Advisory
- https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=83a44ca6057bf9cPatchThird Party Advisory
- https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-auroPatchThird Party Advisory
- https://source.android.com/security/bulletin/pixel/2018-09-01#qualcomm-componentPatchVendor Advisory
- https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=83a44ca6057bf9cPatchThird Party Advisory
- https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-auroPatchThird Party Advisory
FAQ
What is CVE-2018-11276?
CVE-2018-11276 is a vulnerability with a CVSS score of 7.8 (HIGH). In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, double free of memory allocation is possible in Kernel when it explicitly tries to free that...
How severe is CVE-2018-11276?
CVE-2018-11276 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-11276?
Check the references section above for vendor advisories and patch information. Affected products include: Google Android.